Greetings,

Im having an issue with Modbus RTU addressing. My setup is an S7-1212 with a CB1241. The data sheet for the device I am trying to communicate with gives all the Modbus registers as Hex values. I am currently trying to read 3 16 bit registers starting at 0x331A. The function code required is 04.

In my MB Master call I have entered Mode 0, Data_ADDR 413082 (function code 4 with decimal 13082 for 0x331A) and DATA_LEN 3. In response I get error 16#80C9. Blocked_Proc_Timeout was 3.0 and I changed it to 10 with no effect. 

I have attached the protocol description if someone could please help direct me on this addressing issue.

My Bad, I had the wires swapped and I need to pad 1 place. SO, now with the 413082 value for DATA_ADDR my Modbus packet is as follows 01 (dev addr), 03 (I assume modbus command so this should be 04), followed by 33 1A (register address) then 00 03 (number of registers requested) and lastly 2B 48 (CRC). This is returning a status though of 16#8383 

At least that error is as a response from the slave!

Update: Now it really gets weird! Decided to try to read the RTC. This is 3 registers starting at 0x9013. The protocol manual says its a MB code 3 to read and a 10 to write. I entered 336884 and error. Just out of frustration I tried 4336884 and success! If I look at the previous packet catch, it was putting in a MB command 3 when I explicitly told it a 4.Looks like it might be some sort of issue with the Modbus mode, but I cant make heads or tails of how to change it except the leading number in the DATA_ADDR and even that seems to have no effect. On top of that I dont even see a mode "10" listed if I want to try to write the RTC.

Function Code 04 is read input registers.

Function Code 04 uses the register/address memory area identified with the leading numeral 3

Hex 331A is decimal 13082, which would most likely be (3)13083 because in most cases, addresses identified with a leading numeral are one-based addresses, whereas hex addresses are typically zero based.

The leading numeral is NOT used in the actual Modbus message/telegram, only binary, zero based, indexed address is used.

Modbus has no standard/rules for designating addressing, what one gets is a general consensus amongst most implementation.

Believe me, you are not the first to be confused that

FC 03 uses memory (4)xxxx

FC 04 uses memory (3)xxxx

and no one knows why; it just is that way.

Try (3)13083 and see what you get for polling with FC 04.

Thanks for taking the time to get back with me. I did try the leading "3" with no success. In all honesty, I have given up using the 1200 for this and moved to a Wago PFC200 with Codesys (GASP!). That worked correctly straight out of the gate. Given the convoluted way Modbus RTU is implemented in Siemens, I get the feeling is a case of them "grudgingly" including that capability.

If anyone from Siemens is listening, might I suggest a slight change to the function. It would be much clearer is the Modbus function code was independent of the address on the block interface. The way the addressing currently is seems very convoluted.

Hello Frazzled,

If you still want to give it an try you can try the next thing:
Configure Modbus_Load as you normal would do.
Configure Modbus_Master as followed:
MB_ADDR = slave address, probably 1
Mode = 0
Data_ADDR = 9013
DATA_LEN = 3
DATA_PTR = ARRAY [0..2] OF BYTE

give it an REQ to read out the value.

Let me now what you get.

Kind regards,

Kevin

Thanks for getting back with me on this. It is certainly useful information to know (especially the part about different FC's handling different Modbus commands).

Ive decided though to move my master control / data transfer to an IoT2040 running Codesys. The Modbus there is MUCH MUCH cleaner and simpler. Ultimately I will return to an S7-1200 for my engine control but I will be feeding data from my charge controller Modbus registers to the 1200 via Profinet. The Modbus RTU knowledge gained here will not be wasted though. The CB on the 1200 will be used to program a power supply to control the field on my alternator (when that part of the project is implemented). In that case its a much more limited parameter set that I have to control.